llm-cli-gateway 1.5.29 → 1.5.30

package/CHANGELOG.md

@@ -2,6 +2,12 @@
 
 All notable changes to the llm-cli-gateway project.
 
+## [1.5.30] - 2026-05-25
+
+### Fixed
+
+- Quote Windows `.cmd` and `.bat` provider shim invocations through `cmd.exe` to preserve paths with spaces and escape command-processor metacharacters in forwarded arguments.
+
 ## [1.5.29] - 2026-05-25
 
 ### Fixed

package/dist/executor.d.ts

@@ -19,6 +19,7 @@ export declare function envWithExtendedPath(baseEnv?: NodeJS.ProcessEnv, extende
 export interface ResolvedSpawnCommand {
     command: string;
     args: string[];
+    windowsVerbatimArguments?: boolean;
 }
 export declare function resolveCommandForSpawn(command: string, args: string[], options?: {
     envPath?: string;

package/dist/executor.js

@@ -139,11 +139,26 @@ export function resolveCommandForSpawn(command, args, options = {}) {
     if ([".cmd", ".bat"].includes(extname(resolved).toLowerCase())) {
         return {
             command: "cmd.exe",
-            args: ["/d", "/s", "/c", resolved, ...args],
+            args: ["/d", "/s", "/c", `"${buildWindowsCmdCommand(resolved, args)}"`],
+            windowsVerbatimArguments: true,
         };
     }
     return { command: resolved, args };
 }
+function buildWindowsCmdCommand(command, args) {
+    return [escapeWindowsCmdCommand(command), ...args.map(escapeWindowsCmdArgument)].join(" ");
+}
+const WINDOWS_CMD_META_CHARS = /([()\][%!^"`<>&|;, *?])/g;
+function escapeWindowsCmdCommand(value) {
+    return win32.normalize(value).replace(WINDOWS_CMD_META_CHARS, "^$1");
+}
+function escapeWindowsCmdArgument(value) {
+    let arg = `${value}`;
+    arg = arg.replace(/(?=(\\+?)?)\1"/g, '$1$1\\"');
+    arg = arg.replace(/(?=(\\+?)?)\1$/, "$1$1");
+    arg = `"${arg}"`;
+    return arg.replace(WINDOWS_CMD_META_CHARS, "^$1");
+}
 function resolveWindowsCommandPath(command, envPath) {
     if (/[\\/]/.test(command)) {
         return existsSync(command) ? command : null;
@@ -266,6 +281,7 @@ export function spawnCliProcess(command, args, options) {
         cwd: options.cwd,
         detached,
         windowsHide: true,
+        windowsVerbatimArguments: resolved.windowsVerbatimArguments,
         stdio: options.stdio,
         env: options.env,
     });

package/dist/provider-status.js

@@ -106,6 +106,7 @@ function runCommand(command, args, timeoutMs) {
         input: "",
         timeout: timeoutMs,
         windowsHide: true,
+        windowsVerbatimArguments: resolved.windowsVerbatimArguments,
     });
     const output = sanitizeOutput(`${result.stdout || ""}\n${result.stderr || ""}`);
     return {

package/dist/upstream-contracts.js

@@ -551,6 +551,7 @@ export function probeInstalledCliContract(cli, timeoutMs = 5_000) {
             maxBuffer: 1024 * 1024,
             env,
             windowsHide: true,
+            windowsVerbatimArguments: resolved.windowsVerbatimArguments,
         });
         if (result.error) {
             return {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "llm-cli-gateway",
-  "version": "1.5.29",
+  "version": "1.5.30",
   "mcpName": "io.github.verivus-oss/llm-cli-gateway",
   "description": "MCP server providing unified access to Claude Code, Codex, Gemini, Grok, and Mistral Vibe CLIs with session management, retry logic, async job orchestration, durable job results, and cross-LLM validation.",
   "license": "MIT",